# Anyone can deposit and mint withdrawal proxy shares to capture distributed yield from borrower interests

WithdrawProxy inherits public ERC4626Cloned deposit/mint, letting anyone mint shares and capture borrower interest yield without being an LP.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: 0xRajeev
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/176
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-20
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** WithdrawProxy / ERC4626Cloned vault contract
**Root cause:** WithdrawProxy extends ERC4626Cloned which exposes public deposit/mint, but shares are meant to be minted only via PublicVault.redeemFutureEpoch. No override blocks direct deposits.
**Steps:**
1. Call `deposit(WETH, ...)` or `mint(shares, ...)` directly on a deployed WithdrawProxy contract
2. Wait for assets to arrive via `PublicVault.transferWithdrawReserve` or `LiquidationAccountant.claim`
3. Call `redeem`/`withdraw` to receive WETH including distributed borrower interest
**How found:** Code reading: noticed WithdrawProxy inherits ERC4626Cloned's public deposit/mint, while intended share distribution flows only through PublicVault.redeemFutureEpoch.
**Exploitation:** Attacker deposits WETH into WithdrawProxy to mint shares without locking capital for epochs, times entry when borrower interest is being paid, then redeems shares for a proportional cut of the yield that would otherwise go to LPs.
**Insight:** When a contract inherits a vault base (ERC4626) but intends shares to be minted only via an internal privileged path, check whether the inherited public deposit/mint entrypoints are overridden or disabled.